summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Revert "linux-yocto/6.12: riscv: Enable TUNE_FEATURES based KERNEL_FEATURES"walnascarSteve Sakoman5 days1-16/+0
| | | | | | | | | | This reverts commit 9296d038106aebfb66e3a76c4444597e2e1a2263. Since this patch, it looks like qemuriscv64 doesn't boot in Walnascar. (From OE-Core rev: 49f47169953b807d430461ca33f3a2b076119712) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* yocto-uninative: Update to 4.9 for glibc 2.42Michael Halstead8 days1-5/+5
| | | | | | | | (From OE-Core rev: adbb7737cbfbe241df514704b9bb237e41505310) Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* yocto-uninative: Update to 4.8 for GCC 15.1Michael Halstead8 days1-4/+4
| | | | | | | | (From OE-Core rev: ea3a60aabab3b7b456bd086f9e59b42d9ba62ce3) Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0: upgrade 1.24.12 -> 1.24.13Archana Polampalli8 days1-1/+1
| | | | | | | | | | | | | | Below list of CVEs are addressed in this release CVE-2025-47183 CVE-2025-47219 CVE-2025-47806 CVE-2025-47807 CVE-2025-47808 (From OE-Core rev: 340b182d5fc972175f1d2a89127f807073c10255) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-vaapi: upgrade 1.24.12 -> 1.24.13Archana Polampalli8 days1-1/+1
| | | | | | | (From OE-Core rev: 5b918f7a9002472c271f412bec19c6ef9eaf6098) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-rtsp-server: upgrade 1.24.12 -> 1.24.13Archana Polampalli8 days1-1/+1
| | | | | | | (From OE-Core rev: fb4f3b3d2ee5d6098993cf59337b5d982be74b19) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-python: upgrade 1.24.12 -> 1.24.13Archana Polampalli8 days1-1/+1
| | | | | | | (From OE-Core rev: c5742f1c6037c588e91011883b8cf5af6bd360a5) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-ugly: upgrade 1.24.12 -> 1.24.13Archana Polampalli8 days1-1/+1
| | | | | | | (From OE-Core rev: fac2cdbd50d7e1e74910cc4c035471305372d5d7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: upgrade 1.24.12 -> 1.24.13Archana Polampalli8 days1-1/+1
| | | | | | | (From OE-Core rev: 01d4f52c290dc4acc7dd6e129db5470a626bfa90) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: upgrade 1.24.12 -> 1.24.13Archana Polampalli8 days1-1/+1
| | | | | | | (From OE-Core rev: 7b024f5983e83fbde68aaaeaeeff4997d22ba825) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-bad: upgrade 1.24.12 -> 1.24.13Archana Polampalli8 days1-1/+1
| | | | | | | (From OE-Core rev: b819ceba86919df9b99533825dff2efe14164d74) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-libav: upgrade 1.24.12 -> 1.24.13Archana Polampalli8 days1-1/+1
| | | | | | | (From OE-Core rev: d40b0da3070dcd42bed756a47f98b09f04632cab) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gst-devtools: upgrade 1.24.12 -> 1.24.13Archana Polampalli8 days1-1/+1
| | | | | | | (From OE-Core rev: 294522f993b5246ff4a4bf35d1f8fa66c29d1a63) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.1.1198 -> 9.1.1652Peter Marko8 days4-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | Handles CVE-2025-53905, CVE-2025-53906, CVE-2025-55157, CVE-2025-55158. Changes between 9.1.1198 -> 9.1.1652 ==================================== https://github.com/vim/vim/compare/v9.1.1198...v9.1.1652 Refresh patches. Disable newly introduced wayland support (in patch version 1485). To this belongs also adding recursion in delete command for dir auto which was newly failing as there is wayland directory inside now. If someone is interested, this can be probably enabled, but without additional work it results in compilation error due to function redefinition conflicts. (From OE-Core rev: e87d427d928234ef0441f9ce1fe8631fbe471094) (From OE-Core rev: 99e24ba524157ed70ad05b0b1a14fcca8df52246) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-db-native: fix fetcher for CVEs missing nodesPeter Marko8 days1-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | As of now, update of CVE DB from FKIE source (which is the defailt) fails with following error: File: '<build>/poky/meta/recipes-core/meta/cve-update-db-native.bb', lineno: 393, function: update_db_fkie 0389: [cveId, cveDesc, cvssv2, cvssv3, cvssv4, date, accessVector, vectorString]).close() 0390: 0391: for config in elt['configurations']: 0392: # This is suboptimal as it doesn't handle AND/OR and negate, but is better than nothing *** 0393: for node in config["nodes"]: 0394: parse_node_and_insert(conn, node, cveId, False) 0395: 0396:def update_db(d, conn, jsondata): 0397: if (d.getVar("NVD_DB_VERSION") == "FKIE"): Exception: KeyError: 'nodes' Entry for new CVE-2025-32915 is broken. (From OE-Core rev: 5bc27449381d2a53588dc7ad1fe2b78783d5c240) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: set status for CVE-2025-8224Peter Marko8 days1-0/+1
| | | | | | | | | | Commit mentioned in CVE report is already included in current hash. Can be verified by trying to cherry-pick. (From OE-Core rev: c7297f46efa410a9204d3d386d307deada967bb6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch CVE-2025-5918Peter Marko8 days4-0/+590
| | | | | | | | | | | | | Pick commits per [1] Additionally pick a commit needed to apply these cleanly. [1] https://security-tracker.debian.org/tracker/CVE-2025-5918 (From OE-Core rev: 20687d6eed86003eacd5c91ebfd1101f6413ee3f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch CVE-2025-5917Peter Marko8 days2-0/+50
| | | | | | | | | | | Pick commit per [1] [1] https://security-tracker.debian.org/tracker/CVE-2025-5917 (From OE-Core rev: 59b3c2f9dcf523a441bdaeac52c590d469b0b8ac) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch CVE-2025-5916Peter Marko8 days2-0/+112
| | | | | | | | | | | Pick commit per [1] [1] https://security-tracker.debian.org/tracker/CVE-2025-5916 (From OE-Core rev: aa9adf9b4d5b0169dfe44503c247d48538d16929) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: mark CVE-2025-32989 and CVE-2025-32990 as fixedPeter Marko8 days1-0/+3
| | | | | | | | | | | | This is mentioned in [1]. NVD tracks this as version-less CVE. [1] https://gitlab.com/gnutls/gnutls/-/blob/3.8.10/NEWS?ref_type=tags#L8 (From OE-Core rev: 0c84e464d67df1111e62edc5d4f9ad398e19e40a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* linux-firmware: fix FILES to drop RDEPENDS on full packagePatryk Seregiet12 days1-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | linux-firmware-rtl8723 and linux-firmware-adsp-sst contain symlinks to files that were previously packaged only in the main linux-firmware package. This caused both subpackages to inherit an unintended RDEPENDS on the full package. This change resolves the issue by ensuring all required files are correctly included in their respective subpackages. Thanks to Peter Kjellerstedt for figuring out the rootcause. (From OE-Core rev: cf27c7d040e7a5f1bbc60fb36c98686704bd7dc5) (From OE-Core rev: 4b785d2d416944a78bf4c09e85a508ae80e35ca4) Signed-off-by: Patryk Seregiet <patryk.seregiet@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (master rev: cf27c7d040e7a5f1bbc60fb36c98686704bd7dc5) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bash: use -std=gnu17 also for native CFLAGSMartin Jansa12 days1-0/+3
| | | | | | | | | | | | | | | * fixes builds on host with gcc-15: http://errors.yoctoproject.org/Errors/Details/853016/ ../../bash-5.2.37/builtins/mkbuiltins.c:268:29: error: too many arguments to function ‘xmalloc’; expected 0, have 1 268 | error_directory = xmalloc (2 + strlen (argv[arg_index])); | ^~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (From OE-Core rev: 0c09f4a449fc03e6f5dfb6e5961c0a0471a7816d) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pkgconfig: fix build with gcc-15Martin Jansa12 days2-0/+37
| | | | | | | | | | | | | | | | | | | | * on hosts with gcc-15 or whenever glib PACKAGECONFIG isn't enabled and pkgconfig uses own old bundled glib * fixes: http://errors.yoctoproject.org/Errors/Details/853015/ ../../../git/glib/glib/goption.c:169:14: error: two or more data types in declaration specifiers 169 | gboolean bool; | ^~~~ ../../../git/glib/glib/goption.c:169:18: warning: declaration does not declare anything 169 | gboolean bool; | ^ (From OE-Core rev: 092ee1703d81b8aaed452189dd329320483087d3) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix gprofng broken symbolic link with gp-*Harish Sadineni12 days2-0/+63
| | | | | | | | | | | | | | | | | | | | | In binutils 2.44, application names were changed from the gp- prefix (e.g., gp-display-text, gp-archive) to the gprofng- prefix (e.g., gprofng-display-text, gprofng-archive). Temporary gp-* symlinks were added to maintain compatibility with the older gprofng-gui. However, these compatibility symlinks did not support cross-platform toolchain prefixes, which resulted in broken gp-* symbolic links. Support for cross-platform prefixes are added upstream in binutils 2.45, so this change backports that fix to resolve broken symlinks issue. Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=90803ffdcc4d8c3d17566bf8dccadbad312f07a9] (From OE-Core rev: 55684a63904365d8a6ab2a8ce9e091f29b0b7df5) Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: upgrade 1.24.5 -> 1.24.6Peter Marko12 days7-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Upgrade to latest 1.24.x release [1]: $ git --no-pager log --oneline go1.24.5..go1.24.6 7f36edc26d [release-branch.go1.24] go1.24.6 83b4a5db24 [release-branch.go1.24] database/sql: avoid closing Rows while scan is in progress 0f5133b742 [release-branch.go1.24] os/exec: fix incorrect expansion of "", "." and ".." in LookPath 6e1c4529e4 [release-branch.go1.24] cmd/compile: for arm64 epilog, do SP increment with a single instruction 731de13dc3 [release-branch.go1.24] os/user: user random name for the test user account 390ffce7d6 [release-branch.go1.24] runtime: prevent unnecessary zeroing of large objects with pointers b454859a8a [release-branch.go1.24] runtime: stash allpSnapshot on the M Fixes CVE-2025-47906 and CVE-2025-47907 [2]. [1] https://github.com/golang/go/compare/go1.24.5...go1.24.6 [2] https://groups.google.com/g/golang-announce/c/x5MKroML2yM (From OE-Core rev: a348c04d449c0ba36b2ef278bea08919f0e6d19f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> (cherry picked from commit f3072c210ac0a1e4d8046d920c3ebc29f9916b72) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: patch CVE-2025-6052Peter Marko12 days3-1/+135
| | | | | | | | | | | Backport commits from [1] which references this CVE. [1] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4681 (From OE-Core rev: a96c84cb861cb550ddcabd2396a74b00f0035ba4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: update 2.84.2 -> 2.84.4Peter Marko12 days5-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Overview of changes in GLib 2.84.4, 2025-08-08 ============================================== * Bugs fixed: - #3716 (CVE-2025-7039) (#YWH-PGM9867-104) Buffer Under-read on GLib through glib/gfileutils.c via get_tmp_file() (Michael Catanzaro) - #3721 GFile leak in g_local_file_set_display_name during error handling (Philip Withnall, Michael Catanzaro) - !4668 Backport !4667 “Incorrect output parameter handling in closure helper of g_settings_bind_with_mapping_closures” to glib-2-84 - !4675 Backport !4674 “gfileutils: fix computation of temporary file name” to glib-2-84 - !4679 Backport !4677 and !4678 “Fix GFile leak in g_local_file_set_display_name()” to glib-2-84 - !4697 Backport !4696 “gthreadpool: Catch pool_spawner creation failure” to glib-2-84 - !4705 Backport !4702 “gio/filenamecompleter: Fix leaks” to glib-2-84 - !4711 Backport !4708 “gfilenamecompleter: Fix g_object_unref() of undefined value” to glib-2-84 Overview of changes in GLib 2.84.3, 2025-06-13 ============================================== * Bugs fixed: - !4656 Backport !4655 “gstring: Fix overflow check when expanding the string” to glib-2-84 !4656 solves first half of CVE-2025-6052 (From OE-Core rev: 8d5df566ef2c3d342ca0eb2421b4a583b02969da) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: update 2.84.1 -> 2.84.2Praveen Kumar12 days3-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Overview of changes in GLib 2.84.2, 2025-05-20 ============================================== * Bugs fixed: - !4576 Backport !4575 “gclosure: fix ATOMIC_CHANGE_FIELD to read vint atomically” to glib-2-84 - !4595 Backport !4582 “Windows: fix wrong typelib path” to glib-2-84 - !4614 Backport "gstring: carefully handle gssize parameters" - !4616 Backport !4613 “Update macOS job for new CI runner” to glib-2-84 - !4623 Backport !4617 “gdate: Call tzset before localtime_r” to glib-2-84 - !4639 Backport -Wsign-conversion fixes for g_get_locale_variants() from !4590 to glib-2-84 - !4640 Backport !4620 “glocalfile: Disable faccessat()-based query_exists on Android” to glib-2-84 (From OE-Core rev: 3deb6b59f3fa91d4fa755f49dad4ac62c3a518fb) (From OE-Core rev: 45419176357954027607c7f92fd5ad11b5e87a42) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: update 2.84.0 -> 2.84.1Markus Volk12 days4-77/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - remove backport patch Overview of changes in GLib 2.84.1, 2025-04-03 ============================================== * Fix test failure when building against gobject-introspection ≥1.83.4 (#3634, work by Philip Withnall) * Bugs fixed: - #3630 2.84.0 build failure on Linux: ../gio/gnetworkmonitornetlink.c:47:10: fatal error: netlink/netlink_route.h: No such file or directory (Philip Withnall) - #3634 test failure with gobject-introspection 1.83.4: warning: element doc:format from state 3 is unknown, ignoring (Philip Withnall) - #3636 gio/trash does not handle special characters well - #3642 `g_cancellable_connect()` documentation incorrect (Marco Trevisan (Treviño)) - #3643 g_cancellable_connect(): is it safe to unref cancellable from callback? (Marco Trevisan (Treviño)) - #3649 Crash with some registry key values in GWin32AppInfo (Philip Withnall) - !4484 Memory sanitizer fixes - !4489 gobject: Be consistent in using atomic logic to handle the GParamSpecPool - !4541 gsettings: Port docs to gi-docgen format, add missing annotations and make various improvements - !4544 tests: Don't install runner scripts without installed_tests - !4545 Update French translation - !4547 Update Catalan translation - !4548 Update Turkish translation - !4551 Updated Danish translation - !4552 Update Persian translation - !4553 docs: Document GSignalFlags members added after 2.0 - !4554 Update Indonesian translation - !4555 tests: Add a test for g_object_freeze_notify() being called too often - !4557 gfileinfo: Slightly expand docs for g_file_info_get_attribute_as_string() - !4558 gi: Dynamically set doc-format - !4561 tests: Various fixes to create temporary files in /tmp rather than the build directory - !4562 gdbusnameowning: Convert docs to gi-docgen linking syntax - !4563 giounix-private: Fix macro for checking for epoll_create1() - !4565 Fix LGPL in header - !4567 gutils: make documentation of g_set_prgname() clearer - !4568 docs: Add some detail - !4569 Update Romanian translation - !4570 gspawn-win32: Fix potential integer overflows in argv handling - !4571 gvarianttype: Improve docs on type validation * Translation updates: - Catalan (Jordi Mas) - Danish (Ask Hjorth Larsen) - French (Vincent Chatelain) - Indonesian (Andika Triwidada) - Persian (Danial Behzadi) - Romanian (Antonio Marin) - Turkish (Sabri Ünal) (From OE-Core rev: 676b9acbe94f055a351da3bdcfbe457411e1877c) (From OE-Core rev: d818b5952001bacd4dbb24ea475df33e50bc1b53) Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> This upgrade fixes CVE-2025-4056 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1377Soumya Sambu12 days2-0/+69
| | | | | | | | | | | | | | | | | | | | | A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1377 https://ubuntu.com/security/CVE-2025-1377 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=fbf1df9ca286de3323ae541973b08449f8d03aba (From OE-Core rev: 36436f0996d3a84fe6a59434dec1a92704110602) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1376Soumya Sambu12 days2-0/+58
| | | | | | | | | | | | | | | | | | | | | | A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1376 https://ubuntu.com/security/CVE-2025-1376 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=b16f441cca0a4841050e3215a9f120a6d8aea918 (From OE-Core rev: 603881e34e3bbb7435f0ae91553036eef7f1cb06) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1372Soumya Sambu12 days2-0/+52
| | | | | | | | | | | | | | | | | | | | | | A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1372 https://ubuntu.com/security/CVE-2025-1372 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=73db9d2021cab9e23fd734b0a76a612d52a6f1db (From OE-Core rev: 76c57e74071f8f2f312d5c62e1f7a1ac74db54be) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1371Soumya Sambu12 days2-0/+42
| | | | | | | | | | | | | | | | | | | | | A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1371 https://ubuntu.com/security/CVE-2025-1371 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=b38e562a4c907e08171c76b8b2def8464d5a104a (From OE-Core rev: 36a322934f6f7dc8d0890c531d68c0f7de69be13) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1365Soumya Sambu12 days2-0/+153
| | | | | | | | | | | | | | | | | | | | | | A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1365 https://ubuntu.com/security/CVE-2025-1365 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=5e5c0394d82c53e97750fe7b18023e6f84157b81 (From OE-Core rev: deb03581745a0722e1a52a8d4ee63cdc863ad014) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1352Soumya Sambu12 days2-0/+155
| | | | | | | | | | | | | | | | | | | | | | | A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1352 https://ubuntu.com/security/CVE-2025-1352 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=2636426a091bd6c6f7f02e49ab20d4cdc6bfc753 (From OE-Core rev: 9f104c2005975c1dce6e67b23e34ab5a2e8f85ab) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to walnascar head revisionSteve Sakoman2025-08-151-1/+1
| | | | | | (From OE-Core rev: 347cb0861dde58613541ce692778f907943a60ea) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 5.2.3Steve Sakoman2025-08-151-1/+1
| | | | | | (From meta-yocto rev: ce011415ab4e583a4545cd91aceff4190225f31d) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dropbear: patch CVE-2025-47203Peter Marko2025-08-152-0/+374
| | | | | | | | | | | Pick patch per Debian security page [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-47203 (From OE-Core rev: b109c117e68bf44f623124ea1bb2468f3657665c) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/classes.rst: document the testexport classAntonin Godard2025-08-131-0/+16
| | | | | | | | | | | | | This class has been in OE-Core for a while but never documented in the reference manual. Add some description for it and link to the existing documentation on it. (From yocto-docs rev: e664a70adb5bc19041b3b5f553fb90dcddff99d0) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 362a331255525fc853dab3af4ec905c417fabb0b) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: document SPL_DTB_BINARYAntonin Godard2025-08-132-0/+8
| | | | | | | | | | | This variable is part of uboot-sign but not documented. (From yocto-docs rev: ce4a0ec193301ed5373bab02938355ba222d2804) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 05eb461cb1da76ad9cbaf634da7f47447b3f6765) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: document the FIT_CONF_PREFIX variableAntonin Godard2025-08-131-0/+4
| | | | | | | | | | | | Added by commit 7892ee3dc37d ("kernel-fitimage: allow overriding FIT configuration prefix") in OE-Core, but never documented. (From yocto-docs rev: 1b6a3610d5d24580de34b7821413b0f1ea52b508) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 860891492b96eb127af5e7bab6348fca12167c68) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* overview-manual/yp-intro.rst: fix broken link to articleErik Lindsten2025-08-131-1/+1
| | | | | | | | | | (From yocto-docs rev: 2255bff51dc38897243fe48b28fa9773fb6a4e6d) Signed-off-by: Erik Lindsten <erik@awto.se> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit b9680ad83ad3fc5e2b87594f7c62c057134d198b) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/system-requirements.rst: update supported distributionsAntonin Godard2025-08-131-27/+27
| | | | | | | | | | | | | | | | Update the distributions to match the list of workers on the Autobuilder. This list was generated with the help of yocto-autobuilder-helper/scripts/yocto-supported-distros. Also: - Sort the lists alphabetically. - Decrease spacing between entries for readability. (From yocto-docs rev: 378bceec8f5a57d4961df178c141f627e48f0235) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ca-certificates: correct the SRC_URIJiaying Song2025-08-131-1/+1
| | | | | | | | | | The original tarball URL is no longer valid, as it has been moved to an archive location. This update points to the new location. (From OE-Core rev: 69090e41eb0a8b92e0684d391966f9627bfe5195) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: upgrade 3.8.9 -> 3.8.10Gyorgy Sarvari2025-08-132-1/+2
| | | | | | | | | | | | | | | | | | Skip compress-cert-conf test when running ptests, because it requires gnutls to be compiled with brotli PACKAGECONFIG, however brotli is not part of oe-core. Changelog: https://gitlab.com/gnutls/gnutls/-/blob/master/NEWS (From OE-Core rev: 2ad41436acdc5f37803ade51c98ae0dc06103e45) (From OE-Core rev: 26207963abdaeb7767e15c5fdb51b8396c80ab71) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.41 branch updatesPeter Marko2025-08-132-2/+2
| | | | | | | | | | | | | $ git log --oneline 6e489c17f827317bcf8544efefa65f13b5a079dc..e7c419a2957590fb657900fc92a89708f41abd9d e7c419a295 (origin/release/2.41/master, release/2.41/master) iconv: iconv -o should not create executable files (bug 33164) 1e16d0096d posix: Fix double-free after allocation failure in regcomp (bug 33185) Add CVE-2025-8058 to CVE ignore list as this is (bug 33185) commit. (From OE-Core rev: af3e5e432d9bf1e5811ea92f3e29c0874b6b9405) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: fix CVE-2025-8194Praveen Kumar2025-08-132-0/+225
| | | | | | | | | | | | | | | | | | | | | There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8194 Upstream-patch: https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe (From OE-Core rev: c0f1143ca3f189fc6346a445a381829aed78aae8) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: patch CVE-2025-6965Peter Marko2025-08-132-0/+113
| | | | | | | | | | | | | Pick patch [1] mentioned in NVD report [2] from github mirror [3]. [1] https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-6965 [3] https://github.com/sqlite/sqlite/commit/c52e9d97d485a3eb168e3f8f3674a7bc4b419703 (From OE-Core rev: de442af2a5a08518e61d0c76484a3099bac6d46d) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* avahi: fix CVE-2024-52615Zhang Peng2025-08-132-0/+229
| | | | | | | | | | | | | | | | | | CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52615] [https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g] Upstream patches: [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942] (From OE-Core rev: 455f3a936874e62b57d50cc1b84dc816e35312af) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/classes.rst: drop obsolete QA errorsAntonin Godard2025-08-042-14/+1
| | | | | | | | | | | | Drop after commit 068d38214307 ("insane: remove obsolete QA errors") from OE-Core. (From yocto-docs rev: 698253a6c95beb1219b7fed8a90d02fb6ddc5111) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit e5667ae2da1805327ecfff68300c0c460da49b91) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-09-07 04:46:14 +0000